topic Question on transformation commands in Splunk Search

Question on transformation commands

prettysunshinez — Fri, 01 May 2020 16:12:12 GMT

Hi All,

I need your helping in writing post process & base searches..
My dashboard requires a chart command in the first panel..
So having the post process search as below in first panel,I'm unable to write the base searches in the following panels which requires stats,table and sometimes raw data in them..

1st panel :
Search id = "base"

Query - index = source= | regex field1 | regex field2 | chart count over field1 by field2

2nd panel:
I wanted to perform stats count by field 1

3rd panel :
I want to display the raw events for the select value of field1 from the above panel

4th panel :
I want to display stats count by field x

Please suggest me how can i proceed with it.
Will i be able to use streamstats or eventstats in the first panel or is there any other suggestions for this.

Thanks in advance.

Re: Question on transformation commands

richgalloway — Fri, 01 May 2020 17:01:00 GMT

Make panel 3 your base search using index = source= | regex field1 | regex field2. The other panels reference the base search and add their respective transformations.

Re: Question on transformation commands

prettysunshinez — Sun, 03 May 2020 09:13:37 GMT

@richgalloway I would not be able to do that because panel 3 query carries a token of field1 value from Panel 2(cell drilldown)

Re: Question on transformation commands

prettysunshinez — Sun, 03 May 2020 09:27:42 GMT

Any suggestions pls

Re: Question on transformation commands

richgalloway — Mon, 04 May 2020 12:51:16 GMT

Create your base search before the first panel (not in a row). Be aware that this type of base search has limitations. See https://docs.splunk.com/Documentation/Splunk/8.0.3/Viz/Savedsearches#Post-process_searches_2.

<search id="myBaseSearch">
  <query>index= source= | regex field1 | regex field2</query>
</search>
<row>...